A computer resources manager, such as an information technology manager or a network administrator, is responsible for helping to make sure that computer resources such as a software application, a computer system, or a network such as an IP or frame relay network are performing satisfactorily in accordance with end-user needs. Since the computer resources, such as network resources including the available bandwidth on the network, are relied upon, the manager should manage the computer resources in a proactive manner to help ensure effective performance. For example, realistic service level expectations and useful metrics may need to be developed. End-users may demand exceptional service from the computer resources at all hours and may have little patience with or insight into problems such as slow network response times.
Typically, a network or other computer resource operates in patterns of high and low utilization, with corresponding changes in characteristics such as response times. For example, if archival data copying procedures known as xe2x80x9cdata back-upsxe2x80x9d are executed at the end of a day by sending large amounts of data across a network, such procedures may have an adverse effect at that time on response times for software programs that interact with the end-users by sending data across the network (xe2x80x9cinteractive applicationsxe2x80x9d). In other examples, an electronic mail (xe2x80x9cE-mailxe2x80x9d) server""s response time may worsen during early morning working hours when end-users arrive at work and initially open their E-mail accounts, or World Wide Web (xe2x80x9cWebxe2x80x9d) servers and gateways may have added congestion during lunch hours when end-users browse the Web for recreation. In many instances, variations in utilization and the results of such variations, such as inconsistent response times, reflect normal patterns of network traffic or other computer resource utilization resulting from cyclical business processes.
In some cases, more productivity is lost due to variations in application response times than is lost due to consistently slow performance. Further, a deviation from normal patterns of utilization may indicate an important event that requires attention, such as the failure of a critical application.
Existing historical reporting tools for networks typically calculate a daily statistical mean (i.e., average) value for network utilization. As a result, these tools allow the generation of alert or alarm indications or other performance exceptions by detecting above average utilization for a day. However, in at least some cases, the exceptions may in fact be false alarms generated as a result of normal variations that represent times of acceptably high utilization. Also, significant trends and patterns in network performance are typically not represented in the statistical mean value, which lack of representation may lead to inaccurate conclusions about the capacity or configuration of the network.
Computer resources are managed by a method that includes deriving, from historical measurement information for a computer resource, values for statistical variables, and, based on the values, determining whether a behavioral pattern for the computer resource is represented in the historical measurement information.
Different aspects of the invention allow one or more of the following. Network and other computer resource usage can be tracked at a highly granular level, enabling highly meaningful analysis and presentation of information. In the case of a network, performance thresholds can be automatically adapted and kept current, relieving the network administrator of at least some of the burden of analysis and configuration of the network. Rich details of network traffic patterns can be exposed and alert and alarm thresholds can be automatically tuned, allowing effective bandwidth management, capacity planning, and development of realistic service level expectations based on objective information. In at least some cases, network patterns can be analyzed on an hour-by-hour or other day-fractional historical basis, and overgeneration of alarms (xe2x80x9calarm floodsxe2x80x9d) can be avoided, by generating alarms for meaningful events only.
Highly precise baselines of normal performance can be provided, enabling the establishment of suitable application priorities, enhancing the effectiveness of bandwidth management tools, and allowing effective, informed decisions to be made about network performance and capacity. Highly granular indications of which traffic loads are normal and which are aberrant can be provided, allowing network administrators to make effective decisions about network tuning and capacity upgrades, optimize performance during peak traffic periods for critical applications, and tolerate occasional slow-downs for less critical applications. Information regarding trade-offs associated with such optimization or tolerance can be provided.
Information about a network""s behavioral patterns can be provided to end-users, who can then anticipate slow-downs at particular times, and to network maintenance organizations, to allow service level agreements (xe2x80x9cSLAsxe2x80x9d) to be established at an effectively fine level of granularity, with recognition of the trade-offs between the cost of service and upgrades and the cost of occasional slow-downs.
Other features and advantages will become apparent from the following description, including the drawings, and from the claims.